Encoded PowerShell Net Commands

Barsha Sketh@Barshasketh

•updated Sep 17, 2025•4•0•129

Detects PowerShell commands using encoded command-line arguments to execute 'net user', 'net group', or 'net share' commands. This technique is often used by adversaries to obfuscate their actions and evade detection.